CVE-2026-61916: CWE-125 Out-of-bounds Read in Apache Software Foundation Apache bRPC

Apache bRPC versions prior to 1.18.0 contain an out-of-bounds read vulnerability due to improper indexing of two 256-entry lookup tables used in URL parsing and case-insensitive header lookup. On platforms where plain char is unsigned (e.g., ARM64), input bytes with the high bit set (0x80 to 0xFF) are promoted to indices 128 to 255, causing reads beyond the bounds of the lookup tables by up to 127 bytes. This can be triggered remotely via unauthenticated HTTP requests containing crafted URIs or HTTP/2 header names with high-bit bytes. HTTP/1 header names with such bytes are rejected earlier and do not reach the vulnerable code. The vulnerability can cause process crashes and denial of service. The issue is resolved by normalizing lookup indices to the signed-char range before table access, implemented in Apache bRPC 1.18.0 and later.

Remote attackers can cause a denial of service by crashing the Apache bRPC process through crafted HTTP requests containing high-bit bytes in the URI or HTTP/2 header names. This vulnerability affects only platforms where plain char is unsigned, such as ARM64. There is no indication of code execution or data disclosure. HTTP/1 header names with high-bit bytes are rejected before reaching the vulnerable code, limiting the attack surface to HTTP/2 and URL parsing paths.

Upgrade Apache bRPC to version 1.18.0 or later, which includes the fix normalizing lookup-table indices to the signed-char range. Alternatively, apply the patch available at https://github.com/apache/brpc/pull/3376. No other mitigation is required as the vulnerability is addressed by this official fix.